Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

refine docs about NLB #2780

Merged
merged 2 commits into from
Aug 25, 2022
Merged

refine docs about NLB #2780

merged 2 commits into from
Aug 25, 2022

Conversation

M00nF1sh
Copy link
Collaborator

@M00nF1sh M00nF1sh commented Aug 25, 2022 •
edited

Issue

N/A

Description

refine docs about NLB, mainly

  1. organize the documentation of two ways to enable NLB support: loadBalancerClass / service.beta.kubernetes.io/aws-load-balancer-type annotation.
  2. document the security group rules on worker nodes.

Checklist

  • Added tests that cover your change (if possible)
  • Added/modified documentation as required (such as the README.md, or the docs directory)
  • Manually tested
  • Made sure the title of the PR is a good description that can go into the release notes

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 馃く

  • Backfilled missing tests for code in same general area 馃帀
  • Refactored something and made the world a better place 馃専

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Aug 25, 2022
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: M00nF1sh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Aug 25, 2022
kishorj
kishorj reviewed Aug 25, 2022
View reviewed changes
docs/guide/service/nlb.md Outdated
```
By default, Kubernetes Service resources of type `LoadBalancer` was reconciled by the Kubernetes controller built into the CloudProvider component of the kube-controller-manager or the cloud-controller-manager(a.k.a. the in-tree controller).

In order to let AWS Load Balancer Controller manage the reconciliation for Kubernetes Services resources of type `LoadBalancer`, we must offloading the reconciliation from in-tree controller to AWS Load Balancer Controller explicitly.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lets use "you need to offload"
instead of
"we must offloading"

docs/guide/service/nlb.md Outdated
service.beta.kubernetes.io/aws-load-balancer-type: "external"
service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "instance"
```
By default, Kubernetes Service resources of type `LoadBalancer` was reconciled by the Kubernetes controller built into the CloudProvider component of the kube-controller-manager or the cloud-controller-manager(a.k.a. the in-tree controller).
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gets reconciled instead of was reconciled

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1

docs/guide/service/nlb.md

`LoadBalancerClass` feature provides a CloudProvider agnostic way of offloading the reconciliation for Kubernetes Services resources of type `LoadBalancer` to an external controller.

When you specify the `spec.loadBalancerClass` to be `service.k8s.aws/nlb` on a Kubernetes Service resource of type `LoadBalancer`, the AWS Load Balancer Controller takes charge of reconciliation by provision an NLB.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

by provisioning an NLB
instead of
by provision an NLB

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:D

docs/guide/service/annotations.md Outdated
@@ -80,7 +80,7 @@ Traffic Routing can be controlled with following annotations:

- <a name="nlb-target-type">`service.beta.kubernetes.io/aws-load-balancer-nlb-target-type`</a> specifies the target type to configure for NLB. You can choose between
`instance` and `ip`.
- `instance` mode will route traffic to all EC2 instances within cluster on the [NodePort](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport) opened for your service.
- `instance` mode will route traffic to all EC2 instances within cluster on the [NodePort](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport) opened for your service. In this mode, AWS NLB sends traffic to the instances and the kube-proxy on the individual worker nodes then forward it to the Kubernetes pods behind the service.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Second sentence contains some redundant info. Lets say something like:
The kube-proxy on the individual worker nodes sets up the forwarding of the traffic from the NodePort to the pods behind the service.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:D sounds good

docs/guide/service/nlb.md Outdated
When you specify the `spec.loadBalancerClass` to be `service.k8s.aws/nlb` on a Kubernetes Service resource of type `LoadBalancer`, the AWS Load Balancer Controller takes charge of reconciliation by provision an NLB.

!!! warning
- It's not recommended to modify or add the `spec.loadBalancerClass` on an existing Service resource. Instead, delete the existing Service resource and recreate a new one if a change is desired.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

spec.loadBalancerClass field is immutable. Users will not run into this situation.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for pointing this out

docs/guide/service/nlb.md Outdated
## Security group
NLB does not currently support managed security groups. For ingress access, the controller adds inbound rules to the node security group for the instance mode, or the ENI security group for the IP mode. In case of multiple
security groups, the controller expects only one security group tagged with the cluster name as follows:
AWS currently does not support attach security groups to NLB. To allow inbound traffic from NLB, the controller automatically adds inbound rules to worker node security groups by default.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does not suppport attaching security groups or does not support security groups

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i prefer does not suppport attaching security groups to be more specific

docs/guide/service/nlb.md Outdated
## Security group
NLB does not currently support managed security groups. For ingress access, the controller adds inbound rules to the node security group for the instance mode, or the ENI security group for the IP mode. In case of multiple
security groups, the controller expects only one security group tagged with the cluster name as follows:
AWS currently does not support attach security groups to NLB. To allow inbound traffic from NLB, the controller automatically adds inbound rules to worker node security groups by default.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

adds inbound rules to the worker node security groups by default

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1

@kishorj kishorj added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Aug 25, 2022
@kishorj
Copy link
Collaborator

kishorj commented Aug 25, 2022

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 25, 2022
@kishorj kishorj merged commit 65b1809 into kubernetes-sigs:main Aug 25, 2022
Timothy-Dougherty pushed a commit to adammw/aws-load-balancer-controller that referenced this pull request Nov 9, 2023
@M00nF1sh @Timothy-Dougherty
refine docs about NLB (kubernetes-sigs#2780)
82f69f6 
* refine NLB docs

* address comment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kishorj kishorj kishorj left review comments

Assignees

@kishorj kishorj

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@M00nF1sh @k8s-ci-robot @kishorj